ledger-live[.]stratorient[.]com

On July 25, 2026, the domain ledger-live.stratorient.com was identified as an active crypto‑scam impersonating the Ledger brand. The site returns HTTP 200 and presents a page title of “Ledger”, indicating an attempt to appear legitimate to credential‑seeking victims. Registration data shows the domain was created on February 21, 2026 and is registered through GMO Internet Group, Inc. d/b/a Onamae.com. Hosting is provided by Psychz Networks (AS40676) in the United States, resolving to IP address 104.234.134.14.

The TLS certificate is issued by Let’s Encrypt (R13), which is typical for low‑cost or abuse‑oriented infrastructure. Reputation checks reveal a Gridinsoft trust score of 0 / 100 and the domain appears on one security blocklist, with PhishDestroy already listing it as blocked. VirusTotal analysis flags the domain in 12 of 93 scanned security vendors, reinforcing the malicious classification. Detected front‑end technologies include Bootstrap, jQuery and HTTP/3, which are commonly used in phishing kits but do not independently confirm malicious intent.

Nameservers ns1.hostseba.com and ns2.hostseba.com are associated with the hosting provider and have been observed in other abuse reports. While the page content has not been examined directly, the combination of brand impersonation, low trust score, blocklist inclusion, and multiple vendor detections provides strong evidence of a credential‑harvesting operation targeting Ledger users. Defenders should add ledger-live.stratorient.com to URL filtering and DNS blocklists, monitor traffic to the associated IP 104.234.134.14, and consider extending detection rules to include the observed nameserver pattern. Continuous re‑evaluation is advised in case additional subdomains or infrastructure are leveraged in the campaign.